In the dynamic landscape of network management, visibility and efficient troubleshooting are vital components. This latest graduation project, a centralised network logging and analysis system, represents a significant leap forward in addressing these critical needs.

At its core, the system relies on a sophisticated test environment powered by EVE-NG, enabling the simulation of real-world network scenarios characterized by diverse vendor setups and hierarchical structures. Through the utilization of the AF-PACKET method for network traffic capturing, coupled with the analytical capabilities of Zeek and Suricata, the system ensures thorough monitoring and analysis of network activities.

Furthermore, the system seamlessly transmits analyzed packets to Elasticsearch for parsing and long-term storage. User-friendly dashboards in Kibana enhance data accessibility and visualization, making insights readily available.

Extensively tested and proven effective, the system boasts several noteworthy features. Zeek facilitates the reception of syslog from multiple vendors, streamlining log handling across different formats. Moreover, in large networks, the system eliminates the need for manual checks by leveraging Soc alerts to automatically identify and communicate issues, complete with severity levels and device IP addresses. The AF-PACKET method’s capability to capture all network traffic aids in monitoring user behaviors, while Suricata diligently analyzes captured packets to detect intrusions based on predefined rules, promptly generating alerts upon detection.

In summary, the proposed centralized logging system offers markedly improved performance by swiftly identifying potential issues, notifying administrators, and simplifying troubleshooting processes. This results in expedited issue resolution, bolstered network stability, and enhanced reliability. Through this innovative solution, the groundwork is laid for more efficient and secure network management practices.

This graduation project is the work of Yamamah Nidham Ali from the Computer Networks Engineering department supervised by Assist. Lect. Mohammed Ammar.